CVE-2020-12812 is an improper authentication vulnerability in Fortinet FortiOS SSL VPN that allows bypassing the second-factor authentication (FortiToken) by altering the case of the username during login. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
The Play ransomware group has been active since June 2022, targeting businesses and critical infrastructure in North America, South America, and Europe. They gain access by exploiting vulnerabilities, using stolen credentials, and leveraging remote access services. Their attacks follow a double extortion model, encrypting systems after exfiltrating data using AES-RSA hybrid encryption. The group employs various tools for network discovery, credential theft, and lateral movement. Organizations are advised to implement multifactor authentication, regular patching, network segmentation, and maintain offline backups to reduce risk.
